[IP][Mac]Address -> Device Name

yup… thats what I would have thought

192.168.2.8 is my computer
192.168.2.1 is my router
192.168.2.7 is my Synology NAS
192.168.2.6 is a network camera

snmp may not be the right answer or may not be enabled on those devices
you may require multiple methods like bonjour for some, and something else for others

It looks like what you need is a reverse DNS lookup - if you give it an IP address, it’ll ask the DNS server for the corresponding hostname. For this to work, the DNS server must have a “PTR” record for the IP address in question. Given that your IP scanner app is successfully resolving hostnames from IP addresses for you, it sounds like you’re good to go on that front.

To perform a reverse DNS lookup on Mac OS X, you can use the “host” command. For example, “host 192.168.3.7” would give you the hostname for that IP address.

[quote=270637:@Norman Palardy]snmp may not be the right answer or may not be enabled on those devices
you may require multiple methods like bonjour for some, and something else for others[/quote]
multiple sources that I have to tie together is fine… if I could just figure out what those might be :

Well… not so much

iMac-2:~ daveS$ host 192.168.3.7
Host 7.3.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
iMac-2:~ daveS$ host 192.168.3.8
Host 8.3.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
iMac-2:~ daveS$ host 192.168.3.6
Host 6.3.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
iMac-2:~ daveS$ host 192.168.3.1
Host 1.3.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
iMac-2:~ daveS$ 

and for reference here is a screen shot of the “IP SCANNER” app that I have been talking about. not it says 11 devices found, but only display 6 (limit of trial version),

I used “192.168.3.7” as an example IP address - is that a valid IP address on your LAN? If not, substitute an address that is in use on your LAN into the command.

I see from one of your other posts that your Synology NAS is at 192.168.2.7, so you could use:

host 192.168.2.7

duh… my bad… but yeah… I get the same results as I posted above…

except for the router

iMac-2:~ daveS$ host 192.168.2.1
1.2.168.192.in-addr.arpa domain name pointer router.Belkin.

it is the ONLY IP it names

192.168.2.7 returns same error as above… besides… it is not my domain name server… plus… while not shown in screen shot above… at times IP SCANNER even ids my Ipad

Ah, OK - if the router’s the DNS server for the LAN, it wouldn’t know about any of the other internal hostnames. So yes, as Norman says, the IP scanner might be using a combination of methods like Bonjour and NetBIOS lookups.

The screenshot your posted of the scanner is displaying as a broken link for me, so can’t see it. Did the IP scanner successfully come up with the correct hostname for all of your devices, including the network camera?

192.168.2.12 = Apple device/Computer
192.168.2.11 = macLapTop [which is NOT this computer, but another on the LAN]
192.168.2.10 = Manual Device [ not sure but I think this might be my Samsung TV]
192.168.2.9 = Local User [which IS this computer] … this can probably be “guessed”
192.168.2.8 - Apple device/Computer
192.168.2.7 = DiskStation [this is the NAS]

there are 4 computers on this LAN, 1 NAS, a printer, at at times, an iPhone, iPad, iTouch, and Garmin GPS
so I’m guessing the .12, and .8 are two of the other 3 computers

since this the app I’m using (and trying to duplciate part of ) is a TRIAL version, I get different devices shown each time,

fyi … .ran it again and got some others

192.168.2.8 now says iOS device [so its my iTouch I think]
192.168.2.6 says “network camera?”
192.168.2.4 “Daves Ipad” [which is why I think .8 is the touch :slight_smile: ]

Aha! Given that it’s identifying a couple of the IP addresses as “Apple device/Computer”, rather than an actual hostname, I think it’s using the fact that the first half of every MAC address is the Vendor Code. Using that, you can look up the manufacturer of the network card in the device (but nothing more specific than that). See http://www.coffer.com/mac_find/.

Open source IP scanner here.

https://github.com/angryziber/ipscan

thanks for that… but also notice the .8 changed from Apple device/Computer to iOS device when I ran it again , so somewhere (as Norman eluded to) there is MORE information that can be applied

I also notice when the app starts it flashs “Scanning xxxx” message quickly… which each message inferring its looking somewhere differnt for type of data.

[quote=270657:@George Balla]Open source IP scanner here.

https://github.com/angryziber/ipscan[/quote]
perhaps the code will shed more light on the sources of this information… thanks

Yes. I did dredge this up that seems to do that lookup on vendor code, not that I understand it really:

https://web.archive.org/web/20090307025010/http://www.macosxhints.com/article.php?story=20041010213347605

Maybe dump the bits of that IPSCanner thing into a hex editor and look for something recognizable.

Interesting. I came looking to see if anyone had suggestions on this same topic. So as I read I began to think how can those applications do this? If someone wrote that application and can grab the data then I should be able to. So here is most probably a non elegant way to do that and get around something Norma shared about SNMP. SNMP is great except all devices must be set (which they typically are not) to its appropriate Community value and you need to know it in order to make use of it.

If you use arp -a in cli you will get a listing of all devices on the immediate network.

For devices whose info is incomplete type arp hostname or arp ipaddress

Either the IP Address or Hostname will be supplied in the local laptop, desktops arp request. FYI: This can be performed on a MAC or Linux since both use the BSD colonel network aspects. For a PC their is an equivalent value which is the same in this case (I checked this on XP Professional - so it may be different on Windows 10…)

Now a caveat you need to know is the the arp tables for any device is only as good as what it sees. Your or my particular computer may not see everything on our subnet because we are not the DNS-DHCP provider for that subnet. So to see everything on a network you could simply attempt to connect to all IPs in a subnet

i.e. if your network is 192.168.2.0 255.255.255.0 then skip 192.168.2.0 and 192.168.2.255 and try to connect or ping your choice but some devices refuse ping to prevent network attacks to everything else in between. Those connections that fail will simply show up as incomplete when you run arp.

Notice in this example the last two below have a leading ? showing an incomplete. This is because a device occupied that IP Address and is no longer on the network and its information has not yet aged out.

[quote]hostname1 (10.8.32.84) at 12 digit MAC on en0 ifscope [ethernet]
hostname2 (10.8.32.85) at 12 digit MAC on en0 ifscope [ethernet]
? (10.8.32.129) at (incomplete) on en0 ifscope [ethernet]
? (10.8.32.153) at (incomplete) on en0 ifscope [ethernet]
[/quote]
I removed the actual hostname and MACs in the example above

This also shows why when I bring my laptop back onto the network it grabs the same IP Address because that address has not aged out.

So now that you have pinged your entire network you can do arp -a and get the listing of IP and MAC information. You can try this manually to see how it works. First get into terminal and type arp -a and then notice IP Addresses that do not show up in the full subnet range which is typically a network of 255 addresses and we always skip the 0 and 255 members. Then ping one of those missing IP Addresses. Then do arp -a again and see how the arp listing has changed.

FYI: It appears that if you have a MAC Address with leading ‘00’ in its Hexadecimal value string then arp appears to leave off the leading 0. So this MAC Address 00:40:8c:da:f8:18 would show up as this 0:40:8c:da:f8:18. So just make sure you know that you need to prepend a leading 0 to in the first or last values to make a fully compatible 12 digit hexadecimal MAC Address of this device.

You can always check an incomplete response by typing arp ipaddress to see if that value does not lead with a ?. If true then you have new data and you are effectively performing an arp table update for your own purposes.

Now the interesting piece here is to parse this to get what you want and store it for presentation or simply send the output to a TextArea. In this example I used a TextArea

[code] Dim sh As New Shell

#If TargetWin32 Then
sh.Execute(“arp -a”)
#Else
sh.Execute(“arp -a”)
#Endif

If sh.ErrorCode = 0 Then
OutputArea.AppendText(sh.Result)
Else
MsgBox("Error: " + Str(sh.ErrorCode))
End If[/code]

I fail to comprehend where the device name magically appeared based on your posting.

I have refreshed the arp table ping 192.168.2.255
and no matter what combination of things… arp reports ONLY “?” except for my router

arp provides the IP and MAC address for all the devices on my LAN… it does NOT supply the device NAME
attempts at [quote]arg [/quote] resut in UNKNOWN HOST errors

Not saying this doesn’t work on WINDOWS, but is certainly does NOT on OSX

two step process

arp -a this provides ip address and MAC info

then host IPaddress

If a hostname was defined by the DNS service on the Subnet then using ‘host ipaddress’ you get the hostname

I understand what you are saying… and I knew about that process long before I started this topic.
The point is … IT DOESN’T WORK (at least not on my computer, well on ANY of my computers for that matter)

  • ping 198.162.2.255 - insure that arp has the most updated data
  • arp -a - this shows ALL the IP/Mac addresses of the devices in question
  • host results in [quote]host .in-addr.arpa not found : 3(NXDOMAIN)[/quote] for ALL Ip addresses except my ROUTER

which is pretty much what I have been saying since I started this topic

I’d think there might be an issue with your router/network?
I tried the exact steps you mentioned above and it works just fine on the network I’m in.
From ‘arp -a’ I get 29 results and I can get the name using 'host ’ on 22 of them at least :slight_smile:

But the fact that the lan scanner you are using works must mean it’s using some other techniques I guess :confused:

host <ip-address> gives me “address not found”
may be it’s because it’s a private network, not info in external dns datbases
so the host names you find must be in a router somewhere in your network
it does not work for what Dave is asking, get most of the names of un unknown network.